Questions tagged [enumeration]

Pre-attack is a phase where an attacker attempts to discover information about their target. This can involve network reconnaissance, operational intelligence, historical information, etc.

Filter by
Sorted by
Tagged with
0
votes
1answer
81 views

using Uuid for security

I read that uuid does not bring any security advantages But I can't find why It doesn't bring a little bit of extra security in the scenario below ?: Consider that right now the session id is ...
0
votes
0answers
56 views

Username enumeration with multiple inputs

Consider the case of username enumeration, where a hacker is able to determine a username based on UI feedback being different from a successful entry vs a failed entry. For example, a website's ...
0
votes
1answer
323 views

How to prevent Directory Enumeration Attacks (DirB or Directory Buster)

I am dabbling in pen testing (OWASP Juice Shop) and I realized many web application attacks start from enumeration where the attacker uses DirB to find vulnerable Web Objects or Directories to attack ...
1
vote
1answer
161 views

It is possible to enumerate/discover IIS applications from outside?

I wonder if it is possible that someone, from the Internet, could be able to discover services provided via IIS by knowing only the IP address. If yes, how? And how can I protect my IIS from this ...
2
votes
0answers
64 views

How do scanners know which apache2 modules are installed?

My machines routinely get scanned by Qualys and other scanners that report my supported and patched version of php as wildly out of date (even though they're patched quarterly, I get flagged on ...
2
votes
1answer
27 views

Periods in Common Platform Enumeration WFN (NIST Interagency Report 7695 )

I’m looking at NIST Interagency Report 7695 and the grammar described in 5.3.2 seems to say that all . need to be preceded by a \, but this doesn’t seem to be followed in the CPE dictionary. Am I ...
0
votes
1answer
84 views

Enumerating hosts running Elastic Stack

I am currently working on a project where I need to find a host running a SIEM solution. From my research I am fairly confident that the host is running Elastic Stack, probably within another solution ...
2
votes
1answer
355 views

List of common website endings/pages for enumeration? [closed]

I am currently building a Python-based OSINT tool that allows a user to crawl a supplied domain for pages using traditional scraping/spider methods, but I also want to have the option to 'brute force' ...
0
votes
1answer
59 views

How to determine all public IP adresses from within an organization?

I can determine a single public IP address from within the organization (using NAT) by sending a HTTP request to one of the publically available services: curl ipinfo.io/ip However, if my request ...
0
votes
1answer
3k views

How I can enumerate all endpoints of an API?

Let's say I have an API api.example.com and I want to test all endpoints. I don't have access to documentation, how I can enumerate all the endpoints?
10
votes
2answers
897 views

How do exploit kits enumerate or fingerprint their targets?

My current understanding is that an exploit kit will fingerprint (gather information on) a system, check those details against a database of vulnerabilities and then attempt to use the relevant ...
3
votes
1answer
73 views

To what extent should we defend against leaked credentials being tested against our system?

We see these kinds of attempts with some frequency. Normally a leak has happened from some other 3rd party, and an attacker has a big list of known account + password combinations that they can try ...
0
votes
1answer
524 views

how to do internal subdomain enumerations in corp network?

I need to figure out a good way to do internal subdomain enumerations in corp network? My goal is to find the list of internal subdomains in my organizations. I tried https://github.com/TheRook/...
3
votes
1answer
1k views

Can someone explain me the DNSSEC NSEC3 output?

I'm trying to understand how NSEC and NSEC3 records work in DNSSEC. When I query for an non-existent domain with supports NSEC3, I get the following output $ dig +dnssec NSEC3 gggg.icann.org. | grep -...
3
votes
2answers
678 views

What is the key to detecting all IoT devices in your organization? [closed]

In recent news, IoT devices are a target of hackers -- specifically botnet herders. The first step to securing your organization and its users is to detect all IoT devices that are functional on your ...
1
vote
2answers
5k views

Discover Hidden WiFi SSID

How to discover hidden SSIDs ? I know there are tool like WiGLE WiFi (Mobile) which can identify hidden SSID. How those tools are exactly working. How it is discovering hidden SSID WiFi beacons ?
3
votes
2answers
774 views

Fingerprinting servers behind firewall

I am currently testing some servers that are present behind a firewall. During the scanning I am unable identify which ports are open except port 80. I have used various switches for Nmap only -Pn ...
0
votes
0answers
3k views

How to enumerate DCE services on open port 135?

I did a vulnerability scan on a machine and found a DCE Services Enumeration vulnerability. This is described as: Distributed Computing Environment (DCE) services running on the remote host can be ...
1
vote
2answers
1k views

How can you enumerate an internal network with minimal outside knowledge?

The scenario is that you get to plug your laptop into an Ethernet port in some building. You get an IP address (DHCP) and can access the internet. Right out of the gate you know your IP, gateway, ...
3
votes
1answer
120 views

How dangerous is leaking knowledge about existence of objects which the user is not allowed to access?

It is my understanding that good security design does not reveal information about data which the user is not allowed to access. This includes information about the existence of said data, i.e. if a ...
6
votes
1answer
758 views

Are these encrypted URL values safe or could they be guessed?

One of our suppliers had a weakness on the secure section of his webpage. By changing ID's in the URL, we could see data that did not belong to us. For example: https://supplier.org/showItem.do?...
4
votes
1answer
7k views

Beyond Nmap: Investigating open TCP ports bound to unknown services

I have an uninvited guest using my private WLAN. At first I thought it was probably just a tech-savvy neighbour in need of Internet access, in which case; it wouldn't really bother me. However, I've ...
8
votes
1answer
402 views

Strange responses from an unfamiliar HTTP server

I noticed an unfamiliar device when scanning my local wireless network. It had two open (listening?) TCP ports; TCP/80 (http?) & TCP/443 (https?). In an effort to identify the unfamiliar device;...
8
votes
6answers
2k views

Should I use a cryptograpically secure random number generator when I generate IDs?

It is common to generate random identifiers to expose through an API instead of using a simple auto incrementing primary key. The reasons are many: Prevents easy enumeration. Does not give away order ...
7
votes
1answer
3k views

Informative error messages in password reset functionality? [duplicate]

When I am implementing password reset functionality I usually do not include informative messages about whether a user was found, because I have always believed that it can lead to user name ...
1
vote
3answers
406 views

API Method Parameter Enumeration via Web Browser

I am obligated by contract to prevent enumeration of an API method's parameters but cannot achieve it. When I send a blank request to the API server in a web browser, the server responds with the ...
0
votes
1answer
41 views

Subdomain Bruteforcing when every request gets resolved?

Is it possible for an attacker to get a list of the subdomains configured for my server, if every subdomain request gets resolved? In the case of a subdomain that doesn't exist, the server simply ...
1
vote
1answer
494 views

NMAP's explicitely closed ports

I'm working on a challenge and I notice this odd output for a full port scan? abc@desktop:~$ nmap -T5 -p- -sV x.x.x.x -PN Interesting ports on x.x.x.x: Not shown: 65533 filtered ports PORT ...
1
vote
1answer
275 views

Some questions about port-scans

I have two questions and it seems like this website is the perfect place to ask them. I read a post earlier concerning port scans and one of the answers stated something along the lines of: "There is ...
7
votes
3answers
11k views

enumeration and MS DCERPC

Enumeration, enumeration, and even more enumeration is the generic pentesting mantra, but enumeration is worthless if you can't read the results. I came across the Windows RPC service, where ...
1
vote
0answers
326 views

How can a remote attacker find a user UID via Samba?

Is there a way to remotely retrieve the UID of a user via a Samba share? I can get the user list with: rpcclient -W 'WORKGROUP' -c querydispinfo -U''%'' '192.168.21.129' 2>&1 index: 0xa RID: ...
2
votes
1answer
101 views

Avoid brute-force enumeration of customers in a SaaS application

I'm involved in the development of a SaaS application. We host the application for different customers. A customer is a company. Each customer gets access to their hosted instance of the application ...
4
votes
3answers
36k views

Scan all possible files on server (Brute force Filenames)

I'm looking for a tool which can scan all possible filename combinations on a server and tells you what filenames the server responded to. So it would try something like: example.com/a, example.com/b,...
10
votes
2answers
2k views

User Enumeration Vulnerability while creating Google account

When we create a Google account, Google tells us whether an account with specified username exists or not. Doesn't that lead to user enumeration? Why not let users fill other information first, ...
6
votes
1answer
11k views

Discovering a vulnerable service on a machine

I am trying to get access to one of the machines in my lab. it has 2 tcp ports that I am highly suspecting which are: port 25 tcp port 111 tcp For port 25, it is supposed to be running SMTP, however,...
14
votes
4answers
10k views

User name enumeration?

From what I understand it is bad security practice to display informative failed login messages like: The email you entered does not exist Instead of Incorrect email/password combination ...
7
votes
3answers
3k views

How important is CAPTCHA on registration pages?

I am working on a site and I would like to add CAPTCHA to the user registration page to prevent user name enumeration. I am working with a front end developer who feels pretty strongly that we should ...
1
vote
1answer
671 views

Network enumeration protection [closed]

I was reading about DNS security, and readed about Zone Transfer and how can be used to retrieve host information of a network, so not allowing Zone Tranfer from external sources will be the solution ...
6
votes
1answer
5k views

How can I misuse the information of DCE service enumeration?

Nessus reports almost on any Windows machine "DCE service enumaration". With the metasploit module tcp_dcerpc_auditor I get the following information: 192.168.1.23 - UUID 99fcfec4-5260-101b-bbcb-...
4
votes
3answers
2k views

Techniques for fingerprinting a web based content management system (CMS)

Let's say we have a random basic blog or informational website: just some pages with information, a sidebar with an overview of the archives, the normal stuff. We know of this website that it's built ...